A hidden backdoor in the firmware allows passwordless administrator access
The CERT Coordination Center (CERT/CC) has published the vulnerability CVE-2026-11405, which affects multiple router models from the Tenda brand. This is not a run-of-the-mill security flaw, but rather a backdoor intentionally installed in the firmware that grants administrator access to anyone who knows of its existence.
What has been discovered?
The httpd binary of the web server that manages the router’s configuration interface contains an undeclared authentication mechanism. When a user enters credentials that do not match the ones they have configured, the system ignores the username provided and only checks whether the password matches another one stored at the factory in the sys.rzadmin.password parameter.
In other words, even if you change your router’s password, a hidden master password still exists that allows access to the administration panel, without Tenda ever having disclosed its existence.
Affected models
According to the CVE, the firmware where the presence of the backdoor has been confirmed correspond to five models, although it is not ruled out that it may exist in others:
- Tenda AC5
- Tenda AC6
- Tenda AC10
- Tenda FH1201
- Tenda W15E
Who is Tenda?
Tenda (Shenzhen Jixiang Tenda Technology Co., Ltd.) is a Chinese company founded in 1999 in Shenzhen, the country’s technological heart. After consolidating in its domestic market with a very competitive pricing strategy, it began its global expansion in 2007. Today it is a multinational that exports home and professional connectivity hardware —routers, mesh systems, switches and access points— to more than 100 countries.
Its devices are among the best sellers on Amazon, with neutral routers, 4G/5G routers, WiFi mesh systems and repeaters at very tight prices.
What risk does it pose?
The backdoor opens the router’s doors to any attacker who knows this single factory key. Once inside the administration panel, an attacker could:
- Modify the network configuration
- Redirect traffic to malicious sites
- Steal credentials and sensitive data
- Enlist the router into a botnet
- Deploy malware on the devices on the local network
What to do if you have a Tenda router?
So far, Tenda has not made an official statement nor published firmware patches. The recommended measures in the meantime are:
- Disconnect the router from the Internet if its use is not essential
- Isolate it on a separate network (VLAN) from critical devices
- Monitor traffic looking for suspicious connections
- Change routers if possible, opting for brands with a better security track record
- Disable remote access (WAN administration) from the web interface
We will keep you informed when Tenda publishes an official solution or more technical details about this backdoor become known.
— Marta, for intermittent intelligence.
